<html>
<head><meta charset="utf-8"><title>Freeze stabilization and auto-trait backcompat · t-lang · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/index.html">t-lang</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html">Freeze stabilization and auto-trait backcompat</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="214251682"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214251682" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Taylor Cramer <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214251682">(Oct 22 2020 at 21:41)</a>:</h4>
<p>I was thinking about the <code>Freeze</code> proposal (<a href="https://github.com/mtak-/rfcs/blob/freeze/text/0000-freeze.md">https://github.com/mtak-/rfcs/blob/freeze/text/0000-freeze.md</a>) and my objections to it WRT backwcompat</p>



<a name="214251731"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214251731" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Taylor Cramer <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214251731">(Oct 22 2020 at 21:41)</a>:</h4>
<p>and I realized that my concerns are actually generalize-able to stable auto traits (the feature) as well</p>



<a name="214251817"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214251817" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Taylor Cramer <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214251817">(Oct 22 2020 at 21:42)</a>:</h4>
<p>because they allow you to write <code>auto trait DoesntHaveU8 {} impl !DoesntHaveU8 for u8 {}</code></p>



<a name="214251837"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214251837" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Taylor Cramer <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214251837">(Oct 22 2020 at 21:43)</a>:</h4>
<p>which allows you to, at compile-time, introspect for arbitrary field contents of types defined by remote library authors</p>



<a name="214251843"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214251843" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Taylor Cramer <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214251843">(Oct 22 2020 at 21:43)</a>:</h4>
<p>this seems bad^TM</p>



<a name="214251861"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214251861" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Taylor Cramer <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214251861">(Oct 22 2020 at 21:43)</a>:</h4>
<p>Has this come up before?</p>



<a name="214252050"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214252050" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214252050">(Oct 22 2020 at 21:45)</a>:</h4>
<p>I agree it <em>seems</em> bad, but what harm can actually come of it?</p>



<a name="214252160"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214252160" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214252160">(Oct 22 2020 at 21:46)</a>:</h4>
<p>I guess then adding a private <code>u8</code> becomes a breaking change?</p>



<a name="214252188"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214252188" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Taylor Cramer <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214252188">(Oct 22 2020 at 21:47)</a>:</h4>
<p>Yes, exactly.</p>



<a name="214252230"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214252230" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Taylor Cramer <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214252230">(Oct 22 2020 at 21:47)</a>:</h4>
<p>Adding private fields would now be a breaking change unless you already had a field of exactly that type.</p>



<a name="214253229"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214253229" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214253229">(Oct 22 2020 at 21:58)</a>:</h4>
<p>I was trying to think of more practical examples... <code>Freeze</code> already makes adding <code>UnsafeCell</code> a breaking change, but then I realized you can do a type-level opposite of <code>needs_drop</code>:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="n">auto</span><span class="w"> </span><span class="k">trait</span><span class="w"> </span><span class="n">Levitate</span><span class="w"> </span><span class="p">{}</span><span class="w"></span>
<span class="k">impl</span><span class="o">&lt;</span><span class="n">T</span>: <span class="nb">Drop</span><span class="o">&gt;</span><span class="w"> </span><span class="o">!</span><span class="n">Levitate</span><span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="n">T</span><span class="w"> </span><span class="p">{}</span><span class="w"></span>
</code></pre></div>



<a name="214253486"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214253486" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Taylor Cramer <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214253486">(Oct 22 2020 at 22:01)</a>:</h4>
<p>Right, and the concern about <code>Freeze</code> is exactly why I'm extremely hesitant about the idea of stabilizing it.</p>



<a name="214253977"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214253977" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214253977">(Oct 22 2020 at 22:07)</a>:</h4>
<p>The <a href="https://github.com/rust-lang/rust/issues/13231">tracker for OIBIT</a> mentions a problem of conditional negative impls, which I think includes my <code>T: Drop</code> example.</p>



<a name="214254005"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214254005" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214254005">(Oct 22 2020 at 22:07)</a>:</h4>
<p>but I guess "presence of a type" at all is still a conditional negative impl</p>



<a name="214254182"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214254182" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214254182">(Oct 22 2020 at 22:09)</a>:</h4>
<p>it's really no different than the problem of adding a <code>!Send</code> or <code>!Sync</code> field to your type though</p>



<a name="214254452"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214254452" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214254452">(Oct 22 2020 at 22:12)</a>:</h4>
<p>As someone who really wants to use Freeze, the unintentional breaking changes of auto traits is problematic. I feel like Freeze is on the innocuous side because adding an Unsafe cell probably means you're changing the behavior of your struct in a non-trivial way, but it does put an implicit burden on basically all library maintainers.  It would be nice if there was a lint (or something?) that warned about changes to auto traits, especially std library ones.</p>



<a name="214256937"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214256937" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214256937">(Oct 22 2020 at 22:45)</a>:</h4>
<p>If using something like <a href="https://github.com/rust-dev-tools/rust-semverver">Cargo semvar</a> was standard, that would definitely help for std auto traits. However, I can't think of a way in which user definable auto traits won't always present a SemVar hazard. In the case of Freeze, workarounds should be fairly easy and  I believe the likelihood of non-intentional breaking change should be pretty low.</p>



<a name="214257092"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214257092" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214257092">(Oct 22 2020 at 22:48)</a>:</h4>
<p><span class="user-mention silent" data-user-id="127859">Taylor Cramer</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/214251731">said</a>:</p>
<blockquote>
<p>and I realized that my concerns are actually generalize-able to stable auto traits (the feature) as well</p>
</blockquote>
<p>Hm, I am confused by this -- auto traits are not stable, right? There's no way to do this in general on stable today</p>



<a name="214257158"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214257158" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214257158">(Oct 22 2020 at 22:49)</a>:</h4>
<p>Or do you mean that <em>if</em> we had stabilized auto traits, this would be a concern? If so, I agree</p>



<a name="214258326"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214258326" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Taylor Cramer <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214258326">(Oct 22 2020 at 23:08)</a>:</h4>
<p><span class="user-mention" data-user-id="116122">@simulacrum</span> Correct, if we eventually aim to stabilize auto traits, this will be a problem.</p>



<a name="214258669"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214258669" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214258669">(Oct 22 2020 at 23:14)</a>:</h4>
<p><span class="user-mention" data-user-id="327642">@Joshua Chartier</span> As someone who wants to use <code>Freeze</code>, how much of an imposition would it be for you if <code>Freeze</code> weren't an auto trait at all, and instead, types had to <code>#[derive(Freeze)]</code> if they wanted to offer that guarantee going forward? Assume for the sake of argument that types in <code>std</code> and <code>core</code> did so.</p>



<a name="214259001"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214259001" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214259001">(Oct 22 2020 at 23:18)</a>:</h4>
<p>Well,  I want to create an append only log like structure that can be shared memory and reallocate (byte copy where I take care of drops) safely because I know it's not changing. Ideally, I'd really want to be an option for any type that I know wasn't going to change under me.</p>



<a name="214259129"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214259129" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214259129">(Oct 22 2020 at 23:20)</a>:</h4>
<p>Making all the users of this data structure add #derive definitely puts limits on what people can do. Especially in the beginning</p>



<a name="214259237"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214259237" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214259237">(Oct 22 2020 at 23:22)</a>:</h4>
<p>It basically means they couldn't use external structs</p>



<a name="214259358"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214259358" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214259358">(Oct 22 2020 at 23:24)</a>:</h4>
<p>I do think pure-immutability is something that is under exploited in Rust. Though I definitely agree that it's pretty niche so far.</p>



<a name="214259471"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214259471" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214259471">(Oct 22 2020 at 23:26)</a>:</h4>
<p>I absolutely agree that it'd be nice to have widely.</p>



<a name="214259484"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214259484" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214259484">(Oct 22 2020 at 23:26)</a>:</h4>
<p>I'm wondering, in practice, how much of an imposition it'd be to have to get some key external structures to <code>derive(Freeze)</code> so you can use them.</p>



<a name="214259570"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214259570" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214259570">(Oct 22 2020 at 23:28)</a>:</h4>
<p>I think the concerns (at least as I understood them in the meeting discussion) meant that derive(Freeze) / this is not an auto trait doesn't actually help, since it likely means that folks would end up making PRs all over the place and the burden is still on library authors to understand Freeze. I'd personally rather have the auto trait than a derive, I think.</p>



<a name="214259934"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214259934" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214259934">(Oct 22 2020 at 23:33)</a>:</h4>
<p><span class="user-mention" data-user-id="116122">@simulacrum</span> I think the difference is that I'd hope there aren't a <em>massive</em> number of libraries that would need to add <code>Freeze</code> for this to be useful.</p>



<a name="214259960"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214259960" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214259960">(Oct 22 2020 at 23:33)</a>:</h4>
<p>Yeah, I'm not sure derive(Freeze) is particularly useful. If that's the path to prove that these structures are useful, that's fine. I don't think it's a super big deal to have to use derive. But certainly, if it were to be more generally useful, I don't think derive really helps. It's would be like adding copy or clone to 90% of structs</p>



<a name="214259973"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214259973" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214259973">(Oct 22 2020 at 23:33)</a>:</h4>
<p>Some library authors would still have to understand <code>Freeze</code>, but they wouldn't be unexpectedly trapped by it they way they might be if it were an auto trait.</p>



<a name="214260075"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214260075" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214260075">(Oct 22 2020 at 23:34)</a>:</h4>
<p>Hm, so that's true, but it feels similar to things like <code>?Move</code> or whatever -- even if strictly speaking you probably don't care, don't need to do anything (i.e., too niche for me) it ends up being true that "responsible" library authors need to learn about it</p>



<a name="214260216"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214260216" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214260216">(Oct 22 2020 at 23:36)</a>:</h4>
<p>I'm personally thinking that if we want to provide this in std, then the solution is pretty clearly an auto trait IMO</p>



<a name="214260282"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214260282" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214260282">(Oct 22 2020 at 23:37)</a>:</h4>
<p>Agreed. I just don't think there are key structs that get us there. The power is that most structs already support it and if that weren't the case, it wouldn't be very useful</p>



<a name="214260305"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214260305" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214260305">(Oct 22 2020 at 23:37)</a>:</h4>
<p>It's just unfortunate that they don't know that they support it <span aria-label="wink" class="emoji emoji-1f609" role="img" title="wink">:wink:</span></p>



<a name="214260414"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214260414" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214260414">(Oct 22 2020 at 23:39)</a>:</h4>
<p>One question I do have -- perhaps somewhat off topic -- is that I recall hearing/reading that patterns like the ones suggested here are usually UB (even if "work in hardware" is true), as they still having racing reads and writes. Is that not true? (It seems like it must not be)</p>



<a name="214260648"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214260648" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214260648">(Oct 22 2020 at 23:42)</a>:</h4>
<p><span class="user-mention silent" data-user-id="327642">Joshua Chartier</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/214254452">said</a>:</p>
<blockquote>
<p>I feel like Freeze is on the innocuous side because adding an Unsafe cell probably means you're changing the behavior of your struct in a non-trivial way.</p>
</blockquote>
<p>I have no trouble imagining some sort of strategy type where replacing compute-every-time with lookup-in-cache would be a completely reasonable change, FWIW.</p>



<a name="214260667"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214260667" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214260667">(Oct 22 2020 at 23:43)</a>:</h4>
<p>I think that's tough to answer, but you definitely have to be very careful about synchronization. If you really asked me what I wanted, I'd say I want an &amp;immut borrow and freeze is really just a reasonably close approximation</p>



<a name="214260687"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214260687" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214260687">(Oct 22 2020 at 23:43)</a>:</h4>
<p>You don't have to add an unsafe cell; you just have to add an Arc, for instance. Or a Mutex. Or an LRU cache...</p>



<a name="214260755"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214260755" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214260755">(Oct 22 2020 at 23:44)</a>:</h4>
<p><span class="user-mention" data-user-id="327642">@Joshua Chartier</span> I honestly wish that were spelled <code>&amp;</code>, and the current "shared but not immutable" borrow got the more elaborate spelling, but that's the "it's too late for that" I mentioned in the meeting.</p>



<a name="214261025"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214261025" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214261025">(Oct 22 2020 at 23:48)</a>:</h4>
<p>@scottmcm I'm definitely not saying that it couldn't happen. I believe those types of changes tend to be wrapped up in SemVar breaking ways, though maybe that's less true for more mature crates where stability is more important. It's definitely something that should not be taken lightly.</p>



<a name="214261286"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214261286" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214261286">(Oct 22 2020 at 23:53)</a>:</h4>
<p>That's fair.  I definitely imagine happening more in binaries where semver is much less important.</p>



<a name="214261364"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214261364" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214261364">(Oct 22 2020 at 23:55)</a>:</h4>
<p>Or in "single-purpose" crates, that are mostly intended for one dependency chain even though they're a library.</p>



<a name="214261374"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214261374" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214261374">(Oct 22 2020 at 23:55)</a>:</h4>
<p>I do think people should be less afraid of major version bumps.</p>



<a name="214261390"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214261390" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214261390">(Oct 22 2020 at 23:55)</a>:</h4>
<p>All that said, <em>if</em> we're going to make this an auto trait, I'd want an opt-out.</p>



<a name="214261396"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214261396" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214261396">(Oct 22 2020 at 23:55)</a>:</h4>
<p>Some way to <code>impl !Freeze for Type</code>.</p>



<a name="214261448"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214261448" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214261448">(Oct 22 2020 at 23:56)</a>:</h4>
<p>Not just "don't be Freeze if you don't want to be Freeze", and not just "stuff a <code>PhantomUnfreezable</code> in there" because that's more friction to do in practice.</p>



<a name="214261459"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214261459" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214261459">(Oct 22 2020 at 23:56)</a>:</h4>
<p>I've long wanted to stabilize negative impls for marker traits</p>



<a name="214261460"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214261460" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214261460">(Oct 22 2020 at 23:56)</a>:</h4>
<p>I feel like if there's an opt-out, we'd end up keeping the hidden one internally for use in the compiler for the original "can go in readonly memory" purpose...</p>



<a name="214261681"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214261681" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214261681">(Oct 23 2020 at 00:00)</a>:</h4>
<p>I'm excited to see negative impls on everything, even if we're not at the phase of being able to use them for coherence yet.</p>



<a name="214261845"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214261845" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214261845">(Oct 23 2020 at 00:03)</a>:</h4>
<p>Overall, I don't strongly disagree with the decision to close the RFP at least until there is more of a ground swell around the use cases. There is definitely a burden on those who want to be careful  about their libraries and rust is fortunate enough to have numerous of those. I do hope that it is something that could be revisited if there was more proof of its usefulness. It is a bit of a chicken and an egg problem though, if it were more exposed, people might start taking more advantage of it. True immutability could open up some really interesting concurrent data structures and it'd be awesome if we could express them effectively in Rust</p>



<a name="214270817"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214270817" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214270817">(Oct 23 2020 at 03:47)</a>:</h4>
<p><span class="user-mention silent" data-user-id="327642">Joshua Chartier</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/214261845">said</a>:</p>
<blockquote>
<p>Overall, I don't strongly disagree with the decision to close the RFP at least until there is more of a ground swell around the use cases. There is definitely a burden on those who want to be careful  about their libraries and rust is fortunate enough to have numerous of those. I do hope that it is something that could be revisited if there was more proof of its usefulness. It is a bit of a chicken and an egg problem though, if it were more exposed, people might start taking more advantage of it. True immutability could open up some really interesting concurrent data structures and it'd be awesome if we could express them effectively in Rust</p>
</blockquote>
<p>I'm genuinely excited about the idea of immutable data structures for concurrency. (I'm not generally a fan of STM, but I do like other mechanisms for "swap a new version in place atomically" and similar.)</p>



<a name="214270863"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214270863" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214270863">(Oct 23 2020 at 03:48)</a>:</h4>
<p>I personally think <code>Freeze</code> seems reasonable, my only concern is the ecosystem effect of adding a new auto trait.</p>



<a name="214271498"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214271498" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214271498">(Oct 23 2020 at 04:05)</a>:</h4>
<p>Yeah, I think I agree with Taylor's original skepticism about us perhaps ever stabilizing <code>auto trait</code> because of the infectiousness.</p>
<p>I guess to be willing to do it we'd need to have a super-general opt-out mechanism for all of them, but that's also pretty painful since it means needing to opt back into <code>Send</code>, which sounds like a good way for people to start doing it by rote, and then potentially doing it wrong.  Hmm, maybe the big opt-out could allow a non-unsafe <code>impl Send for Foo;</code> that only works if all the fields are <code>Send</code>...</p>



<a name="214277493"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214277493" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Lifshay <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214277493">(Oct 23 2020 at 06:14)</a>:</h4>
<p><span class="user-mention silent" data-user-id="125270">scottmcm</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/214271498">said</a>:</p>
<blockquote>
<p>Hmm, maybe the big opt-out could allow a non-unsafe <code>impl Send for Foo;</code> that only works if all the fields are <code>Send</code>...</p>
</blockquote>
<p>How about <code>#[derive(Send)]</code> automatically adding an impl:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">unsafe</span><span class="w"> </span><span class="k">impl</span><span class="w"> </span><span class="nb">Send</span><span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="n">Foo</span><span class="w"></span>
<span class="k">where</span><span class="w"> </span><span class="p">(</span><span class="o">&lt;</span><span class="n">Foo</span><span class="o">'</span><span class="na">s</span><span class="w"> </span><span class="n">fields</span><span class="o">&gt;</span><span class="p">,)</span>: <span class="nb">Send</span><span class="p">,</span><span class="w"></span>
<span class="p">{</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>

<p>seems better than inventing new custom syntax.</p>



<a name="214284872"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214284872" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214284872">(Oct 23 2020 at 08:18)</a>:</h4>
<p>Any variety of things could work.  I was just hoping for something that wouldn't take unsafe in the crate, so that <code>cargo geiger</code> or whatever wouldn't go "You need to audit this".</p>



<a name="214323262"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214323262" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214323262">(Oct 23 2020 at 14:50)</a>:</h4>
<p><span class="user-mention" data-user-id="239881">@Josh Triplett</span>  <a href="https://github.com/jonhoo/rust-evmap">evmap</a> is another potential use case. It's pretty easy to imagine an implementation that replaces the Clone bound with  Freeze.  That would expand the number of usable cases for evmap while making it more efficient by removing needless cloning and dropping. It also has a ShallowCopy trait and derive macro so talking to the maintainers might be good datapoint on how burdensome the use of a derive() is in practice. I've added an <a href="https://github.com/jonhoo/rust-evmap/issues/71">issue</a> to evmap asking them to comment.</p>



<a name="214331399"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214331399" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214331399">(Oct 23 2020 at 15:58)</a>:</h4>
<p><span class="user-mention" data-user-id="125270">@scottmcm</span> Your global opt out method could also allow you to exclude certain auto traits, which might let you limit the unsafe. Another piece that I think might be interesting is if std lib pub auto traits could be tied to editions. Previous editions would have to be explicit opt in and therefore would only be breaking if the library authors changed their minds, but in newer editions they would become explicit opt out and SemVar compatibility is something that has to be considered as part of the contract for the new edition.</p>



<a name="214334682"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214334682" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214334682">(Oct 23 2020 at 16:27)</a>:</h4>
<p>Editions generally can't affect the library.  I guess you could get different auto traits depending on where you compiled by having the compiler auto-opt-out of some of them depending on the edition used to compile the crate that defined the type?  Feels a bit weird, though...</p>



<a name="214340331"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214340331" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214340331">(Oct 23 2020 at 17:14)</a>:</h4>
<p>Yep, that's the idea. In theory adding  an auto trait wouldn't break a library, though changing the edition the library could create a semvar hazard,  but that's pretty unavoidable for auto traits and at least this gives a clear place where it needs to be considered. In practice, I have no idea if this is even remotely feasible, and it's a huge leap from adding a pub to an existing trait, so, yeah... but if new auto traits are going to be a thing, this might be a way to do it in a consistent and, hopefully, manageable way.</p>



<a name="214344453"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214344453" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214344453">(Oct 23 2020 at 17:49)</a>:</h4>
<p><span class="user-mention silent" data-user-id="327642">Joshua Chartier</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/214259001">said</a>:</p>
<blockquote>
<p>Well,  I want to create an append only log like structure that can be shared memory and reallocate (byte copy where I take care of drops) safely because I know it's not changing. Ideally, I'd really want to be an option for any type that I know wasn't going to change under me.</p>
</blockquote>
<p>given that <code>Box&lt;Cell&lt;T&gt;&gt;</code> is <code>Freeze</code> and otherwise has basically the same API behavior as <code>Cell&lt;T&gt;</code>... I wonder what the concrete guarantee for a type is that this append-only log would need?</p>



<a name="214346492"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214346492" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214346492">(Oct 23 2020 at 18:05)</a>:</h4>
<p>The guarantee needed is that I can copy the bytes of the struct (top level only, i.e. the just the pointer in box) from one location to another while still being able to read and potentially dereference those bytes from both locations. Structs will be be deallocated when no longer in use and when the last copy of the struct is to be deallocated drop will be called.  Cell&lt;T&gt; can't directly be copied because it might catch T in an invalid state, this should not be a problem with Box&lt;Cell&lt;T&gt;&gt; since existing references are still valid.</p>



<a name="214346660"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214346660" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214346660">(Oct 23 2020 at 18:06)</a>:</h4>
<p>T can also not be self-referential, but I think that is already covered by Rust move-ability constraints</p>



<a name="214346923"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214346923" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214346923">(Oct 23 2020 at 18:08)</a>:</h4>
<blockquote>
<p>Cell&lt;T&gt; can't directly be copied because it might catch T in an invalid state</p>
</blockquote>
<p>ah so specifically you want to do this concurrently with other potential accesses?</p>



<a name="214347079"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214347079" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214347079">(Oct 23 2020 at 18:09)</a>:</h4>
<p>Yes. Though definitely let me know if there's some pointer aliasing thing going on in the compiler that makes it so this isn't a safe thing to do.</p>



<a name="214347170"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214347170" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214347170">(Oct 23 2020 at 18:10)</a>:</h4>
<p><code>Cell</code> specifically is a strange example here though... <code>Cell&lt;T&gt;: Copy</code> would be sound (if <code>T: Copy</code>). but your approach sounds like it should definitely work for any <code>Copy</code> type. ergo it should also work for <code>Cell</code>.</p>



<a name="214347233"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214347233" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214347233">(Oct 23 2020 at 18:10)</a>:</h4>
<p><span class="user-mention silent" data-user-id="327642">Joshua Chartier</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/214347079">said</a>:</p>
<blockquote>
<p>Yes. Though definitely let me know if there's some pointer aliasing thing going on in the compiler that makes it so this isn't a safe thing to do.</p>
</blockquote>
<p>I'd need to look more closely at what concretely happens. do you have a small self-contained example of the kind of thing you'd like to do to a <code>T</code>/<code>&amp;T</code>?</p>



<a name="214347644"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214347644" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214347644">(Oct 23 2020 at 18:14)</a>:</h4>
<p>How small is small? Here's some <a href="https://github.com/jfcha/imm-ds/blob/a1fdfe4f0d40925c98da8092d8f5a95b362c54cf/arc-log/src/arc_log.rs#L577">test code</a>. I'm still in the process of getting my code crate ready, but hopefully this will give you an idea.</p>



<a name="214349804"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214349804" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214349804">(Oct 23 2020 at 18:32)</a>:</h4>
<p><span class="user-mention silent" data-user-id="327642">Joshua Chartier</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/214347644">said</a>:</p>
<blockquote>
<p>How small is small? Here's some <a href="https://github.com/jfcha/imm-ds/blob/a1fdfe4f0d40925c98da8092d8f5a95b362c54cf/arc-log/src/arc_log.rs#L577">test code</a>. I'm still in the process of getting my code crate ready, but hopefully this will give you an idea.</p>
</blockquote>
<p>hm, I was hoping for something that just demonstrates the core principle without being nicely wrapped in an API^^ but maybe that is too much to ask</p>



<a name="214349878"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214349878" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214349878">(Oct 23 2020 at 18:33)</a>:</h4>
<p>The basic structure is a blend of Arc and RawVec (hence all the nightly usage). Each allocation keeps it's own reference count of all it's reference clones and has a forward pointer. There's a spin lock on write and when a write reaches capacity, it adds a forward pointer to a new allocation and copies all the bytes. The other clones can then call update(&amp;mut self) to move their pointers to the new allocation when they are ready.</p>



<a name="214349909"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214349909" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214349909">(Oct 23 2020 at 18:33)</a>:</h4>
<p>what do you think about <code>Cell&lt;T&gt;</code> being <code>Copy</code> though? I have a proof that that is sound, so if it would be a problem for you then something very interesting would definitely be going on</p>



<a name="214350019"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214350019" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214350019">(Oct 23 2020 at 18:34)</a>:</h4>
<p><span class="user-mention silent" data-user-id="327642">Joshua Chartier</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/214349878">said</a>:</p>
<blockquote>
<p>The basic structure is a blend of Arc and RawVec (hence all the nightly usage). Each allocation keeps it's own reference count of all it's reference clones and has a forward pointer. There's a spin lock on write and when a write reaches capacity, it adds a forward pointer to a new allocation and copies all the bytes. The other clones can then call update(&amp;mut self) to move their pointers to the new allocation when they are ready.</p>
</blockquote>
<p>thanks; putting it on my weekend list (but I cant promise I'll get through the entire list^^)</p>



<a name="214350050"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214350050" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214350050">(Oct 23 2020 at 18:34)</a>:</h4>
<p>Or they can keep referencing  the old allocation by &amp;.</p>
<p>Is Cell&lt;T&gt;:Clone also Sync? I think that would be where my hang up would be</p>



<a name="214350085"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214350085" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214350085">(Oct 23 2020 at 18:35)</a>:</h4>
<p>no <code>Cell</code> is never <code>Sync</code></p>



<a name="214350099"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214350099" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214350099">(Oct 23 2020 at 18:35)</a>:</h4>
<p>that would be very unsound</p>



<a name="214350507"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214350507" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214350507">(Oct 23 2020 at 18:38)</a>:</h4>
<p>Does copy also copy the T? Or is it a shallow copy?</p>



<a name="214350793"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214350793" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214350793">(Oct 23 2020 at 18:41)</a>:</h4>
<p>I dont understand the question... an implicit copy is always shallow in Rust, but a shallow copy of a <code>Cell&lt;T&gt;</code> (where <code>T: Copy</code>) copies the <code>T</code> of course</p>



<a name="214351465"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214351465" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214351465">(Oct 23 2020 at 18:47)</a>:</h4>
<p>Sorry, I'm a little slow on this. I think, I get it now. The point is that Cell&lt;T&gt; : Copy gives you a new Cell that can change in place, that happens to have the same value as the old Cell. Which is useful. Minus the sync part it would be safe in my setup, though it would lead to surprising behavior.</p>



<a name="214361977"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214361977" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214361977">(Oct 23 2020 at 20:27)</a>:</h4>
<p><span class="user-mention" data-user-id="327642">@Joshua Chartier</span> Would <code>Pin</code> help you at all?</p>



<a name="214362000"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214362000" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214362000">(Oct 23 2020 at 20:27)</a>:</h4>
<p>Or rather, <code>Unpin</code>?</p>



<a name="214363845"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214363845" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214363845">(Oct 23 2020 at 20:44)</a>:</h4>
<p><span class="user-mention" data-user-id="239881">@Josh Triplett</span>  I had originally thought  I needed Freeze + Unpin, but I don't think so any more. Mostly because I expect ArcLog&lt;T&gt; to own T going in. So if T is already a pointer (and Pin only takes a pointer), I don't have a problem because copying/moving a pointer is fine. I don't give out &amp;mut access to any of my inner data, so Pin is pretty irrelevant. If Rust starts having a Move trait that allows self referential structs I'll have a problem, though, because I am invalidating the self references. But I think that's a general problem and not allowed (safely) in Rust anyway.</p>



<a name="214371406"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214371406" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214371406">(Oct 23 2020 at 22:10)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> <span class="user-mention" data-user-id="239881">@Josh Triplett</span>  Here's a <a href="https://github.com/jfcha/imm-ds/blob/master/arc-log/ArcLog.jpg">simple diagram</a> of the key functionality. The diagram only shows two references, but there could be N different references on M different threads and at any time a given reference could have &amp; borrows in the form of slices (no &amp;mut slices). The only time &amp; borrowed slices may not exist for a given reference is when &amp;mut self calls are needed for that reference to push/update/drop (i.e. normal rust rules). The key step is the reallocation in step  4.  That's where the Freeze bound comes into play. The thought is that if T has no interior mutability it's safe to just copy the bytes. Copy is stronger than I need, because I can still guaranteed drop is called, and only called once. Clone would work, but then you're paying the price for clones and drops on all allocations. Box could also work, but then you're paying for the extra indirection. I would definitely love to know if there's some reason that Freeze is not a strong enough guaranteed to safely copy and eventually deallocate and finally drop. It seems to generally be working, but my testing is still pretty limited at this point.</p>
<div class="message_inline_image"><a href="https://github.com/jfcha/imm-ds/blob/master/arc-log/ArcLog.jpg" title="simple diagram"><img src="https://raw.githubusercontent.com/jfcha/imm-ds/master/arc-log/ArcLog.jpg"></a></div>



<a name="214416919"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214416919" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214416919">(Oct 24 2020 at 09:07)</a>:</h4>
<p><span class="user-mention" data-user-id="327642">@Joshua Chartier</span> Which program did you use to make that diagram?</p>



<a name="214433293"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214433293" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214433293">(Oct 24 2020 at 15:27)</a>:</h4>
<p><span class="user-mention" data-user-id="133247">@bjorn3</span>  I used <a href="https://github.com/jgraph/drawio-desktop">diagrams.net</a>. I haven't used it a ton, but so far I like it. They also have an online version, but I prefer the desktop application.</p>



<a name="214433903"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214433903" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214433903">(Oct 24 2020 at 15:40)</a>:</h4>
<p>Thanks. I will take a look.</p>



<a name="214508632"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214508632" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214508632">(Oct 25 2020 at 19:53)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span>  I was thinking about Cell&lt;T&gt; being Copy and my ArcLog&lt;T&gt;. Even in a single threaded version that didn't require Sync (RcLog!) I would not want to allow Cell in my Ts. It wouldn't be unsafe, but the behavior would be surprising if you made a change via an &amp; borrow, updated RcLog to get new items and that change was no longer there. I want my allocations to maintain byte for byte equality for items that exist in multiple allocation. Cell&lt;T&gt; could circumvent that, copy or not.</p>
<p>Separately, I do have a use for Cell&lt;T&gt; being Copy, if you're looking for use cases. Right now my ArcLog reference counts because I assume that memory is a constraint. If it wasn't and I never needed to deallocate, I could create a new type of log structure, let's call it SharedLog,<br>
<code>struct SharedLog&lt;T: Freeze&gt; { ptr: Cell&lt;NonNull&lt;InnerSharedLog&lt;T&gt;&gt;&gt; } </code> <br>
and it could be Copy like any other pointer and I could update it to point to the newest allocation on any dereference so it could always be up to date. That would make for a really nice user experience. That said, I think Cell&lt;T&gt; being Copy would be a huge footgun (and why I was confused earlier). I don't expect to get a new Cell if I move it (aka, call it by new name), even if its T is Copy. But if it were a different struct, say CopyCell&lt;T&gt;, and I knew that I had to be careful about moves, it could definitely be useful!</p>



<a name="214509294"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214509294" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214509294">(Oct 25 2020 at 20:06)</a>:</h4>
<p>Right, there are good reaosns for making <code>Cell</code> not <code>Copy</code> that are unrelated to soundness, which is why the usual proposals there involve some lints or so, I think</p>



<a name="214509302"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214509302" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214509302">(Oct 25 2020 at 20:06)</a>:</h4>
<p>I was mostly curious if you were relying on <code>Copy</code> implying <code>Freeze</code> (which is the case currently but broken by making <code>Cell: Copy</code>)</p>



<a name="214607990"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214607990" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214607990">(Oct 26 2020 at 17:38)</a>:</h4>
<p><span class="user-mention silent" data-user-id="127859">Taylor Cramer</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/214251861">said</a>:</p>
<blockquote>
<p>Has this come up before?</p>
</blockquote>
<p>Yes, it has definitely come up before.</p>



<a name="214608275"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/214608275" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#214608275">(Oct 26 2020 at 17:40)</a>:</h4>
<p>I am not sure whether auto traits will ever be something we permit outside the stdlib for this reason</p>



<a name="215032796"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215032796" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215032796">(Oct 29 2020 at 21:46)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span>  Random question of the day: Should the field <em>value</em> of  MaybeUninit&lt;T&gt; actually be ManuallyDrop&lt;UnsafeCell&lt;T&gt;&gt; instead of just ManuallyDrop&lt;T&gt;? I was thinking of this in the terms of Freeze and how you can't count on the byte representation of a MaybeUninit. I doubt it makes any real difference in the given usage, but it seemed to fit in the same conceptual bucket.</p>



<a name="215033115"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215033115" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215033115">(Oct 29 2020 at 21:50)</a>:</h4>
<p>does that include an initialized <code>MaybeUninit&lt;T&gt;</code>?</p>



<a name="215034151"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215034151" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215034151">(Oct 29 2020 at 22:00)</a>:</h4>
<p>I think this (<a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=649399a6e71aa952f0270eedb8915a14">playground link</a>) is a program that is UB only if initialized MaybeUninits are not in an unsafecell:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">use</span><span class="w"> </span><span class="n">std</span>::<span class="n">mem</span>::<span class="n">MaybeUninit</span><span class="p">;</span><span class="w"></span>
<span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">MaybeUninit</span>::<span class="n">new</span><span class="p">(</span><span class="mi">1</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">y</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="n">x</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">*</span><span class="p">(</span><span class="n">x</span><span class="p">.</span><span class="n">as_ptr</span><span class="p">()</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="kt">u32</span><span class="p">)</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">2</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="n">println</span><span class="o">!</span><span class="p">(</span><span class="s">"{}"</span><span class="p">,</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">y</span><span class="p">.</span><span class="n">assume_init</span><span class="p">()</span><span class="w"> </span><span class="p">})</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="215035054"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215035054" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215035054">(Oct 29 2020 at 22:10)</a>:</h4>
<p>I don't think it should be conflated with mutability. You can use <code>MaybeUninit&lt;UnsafeCell&lt;T&gt;&gt;</code> if needed.</p>



<a name="215035518"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215035518" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215035518">(Oct 29 2020 at 22:16)</a>:</h4>
<p>I would think it only matters for the uninitialized, so maybe I should have been pointing at <em>init</em> instead of <em>value</em>. I was thinking about the Freeze auto trait and it seem like MaybeUninit should not be Freeze. But yeah, maybe that's a distinction that should be separate from mutability.</p>



<a name="215035908"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215035908" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215035908">(Oct 29 2020 at 22:21)</a>:</h4>
<p>I think it should be freeze, because the compiler is free to assume that it cannot be mutably aliased, because the only way it differs from a <code>T</code> is when the value is uninitialized in which case a write cannot race any read because all reads are UB</p>



<a name="215067252"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215067252" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215067252">(Oct 30 2020 at 08:42)</a>:</h4>
<p><span class="user-mention silent" data-user-id="327642">Joshua Chartier</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/215032796">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span>  Random question of the day: Should the field <em>value</em> of  MaybeUninit&lt;T&gt; actually be ManuallyDrop&lt;UnsafeCell&lt;T&gt;&gt; instead of just ManuallyDrop&lt;T&gt;? I was thinking of this in the terms of Freeze and how you can't count on the byte representation of a MaybeUninit. I doubt it makes any real difference in the given usage, but it seemed to fit in the same conceptual bucket.</p>
</blockquote>
<p>no, there is no interior mutability here</p>



<a name="215067292"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215067292" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215067292">(Oct 30 2020 at 08:43)</a>:</h4>
<p><code>UnsafeCell</code> is specifically granting the power to mutate data behind a shared reference</p>



<a name="215067309"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215067309" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215067309">(Oct 30 2020 at 08:43)</a>:</h4>
<p>that is fully orthogonal to whether you are working with uninitialized data. usually in Rust we strive to have APIs that do one thing and one thing only... like, we could merge <code>Arc</code> and <code>RwLock</code> into a single type for a "thread-safe freely sharable pointer to concurrently accessible data", but that would be a bad design decision as the pieces are independently useful. the same is true for <code>MaybeUninit</code> and <code>UnsafeCell</code>.</p>



<a name="215067333"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215067333" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215067333">(Oct 30 2020 at 08:43)</a>:</h4>
<blockquote>
<p>I think this (playground link) is a program that is UB only if initialized MaybeUninits are not in an unsafecell:</p>
</blockquote>
<p>this program is indeed UB and is intended to be UB. why do you think that this is an okay way to use <code>MaybeUninit</code>? You are mutating through a shared reference!</p>



<a name="215067403"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215067403" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215067403">(Oct 30 2020 at 08:44)</a>:</h4>
<p>the <a href="https://doc.rust-lang.org/nightly/std/mem/union.MaybeUninit.html#method.as_ptr">docs for <code>MabyeUninit::as_ptr</code></a> explicitly say</p>
<blockquote>
<p>Writing to memory that this pointer (non-transitively) points to is undefined behavior (except inside an UnsafeCell&lt;T&gt;).</p>
</blockquote>



<a name="215067418"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215067418" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215067418">(Oct 30 2020 at 08:44)</a>:</h4>
<p>this is the same for basically all the <code>as_ptr</code> methods in the stdlib</p>



<a name="215067432"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215067432" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215067432">(Oct 30 2020 at 08:44)</a>:</h4>
<p>I don't think there is any good reason to make this one an exception</p>



<a name="215080705"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215080705" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215080705">(Oct 30 2020 at 11:11)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/215067333">said</a>:</p>
<blockquote>
<blockquote>
<p>I think this (playground link) is a program that is UB only if initialized MaybeUninits are not in an unsafecell:</p>
</blockquote>
<p>this program is indeed UB and is intended to be UB. why do you think that this is an okay way to use <code>MaybeUninit</code>? You are mutating through a shared reference!</p>
</blockquote>
<p>I <em>do</em> think it should be UB. Sorry for not making that clear. The idea was to get a concrete example of a program that would be affected by the proposed change</p>



<a name="215081025"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215081025" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215081025">(Oct 30 2020 at 11:15)</a>:</h4>
<p>Also, the program can be modified to start with <code>MaybeUninit::uninit()</code> instead of <code>MaybeUninit::new(1)</code> and you get the same result: currently UB, detected by miri, would be defined under the proposal, and in this case it is even the uninit value being non-freeze, not just a defined value in a <code>MaybeUninit</code></p>



<a name="215081059"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215081059" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215081059">(Oct 30 2020 at 11:16)</a>:</h4>
<p>also FWIW, I'd use <code>UnsafeCell&lt;MaybeUninit&lt;T&gt;&gt;</code> which will work better with the stable APIs, and it better conveys that even the initialziation status may change</p>



<a name="215081292"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215081292" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215081292">(Oct 30 2020 at 11:18)</a>:</h4>
<p>Wait, are those different? Specifically, is it UB to write to an uninitialized <code>MaybeUninit&lt;UnsafeCell&lt;T&gt;&gt;</code> through a shared pointer?</p>



<a name="215081392"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215081392" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215081392">(Oct 30 2020 at 11:19)</a>:</h4>
<p>I recall there being some other discussions about unsafecells in unions but I'm not sure how that all works</p>



<a name="215092585"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215092585" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215092585">(Oct 30 2020 at 13:16)</a>:</h4>
<p>I feel like making a difference is a good way to simplify the interactions through shared references to <code>MU</code>, see <a href="https://github.com/rust-lang/rust/issues/66699#issuecomment-709223948">https://github.com/rust-lang/rust/issues/66699#issuecomment-709223948</a></p>



<a name="215145714"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215145714" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215145714">(Oct 30 2020 at 20:18)</a>:</h4>
<p>Hmm. I guess I was thinking of a Freeze bound as a guarantee that if I do a shallow read of the bytes of this type, I will always get the same result (aka, the functional programming ideal of run with same inputs, get the same results). And since reading a MaybeUninit can be UB,  that does not hold. But no interior mutability is different, literally what's in code, and also useful. I definitely appreciate the clarification. Unfortunately, this leads to my next question. Is there some trait equivalent to !MaybeUninit, aka, something that says T is always safe to read? And if not, how about another semvar hazard auto trait! Sadly, only half kidding. Also, if reading from MaybeUninit can be UB, how is Vec&lt;MaybeUninit&lt;T&gt;&gt; safe when it has capacity increasing reallocations? Is copying the bytes not actually considered a read?</p>



<a name="215145827"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215145827" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215145827">(Oct 30 2020 at 20:19)</a>:</h4>
<p>Reading a MaybeUninit at type MaybeUninit is not UB</p>



<a name="215145836"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215145836" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215145836">(Oct 30 2020 at 20:20)</a>:</h4>
<p>and memcpy or realloc do so</p>



<a name="215146005"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215146005" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215146005">(Oct 30 2020 at 20:21)</a>:</h4>
<p>OOhhh. Ok. Thanks. That makes a lot of sense. It's only when you look inside. Sorry for the noise.</p>



<a name="215188983"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215188983" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215188983">(Oct 31 2020 at 12:16)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/215081292">said</a>:</p>
<blockquote>
<p>Wait, are those different? Specifically, is it UB to write to an uninitialized <code>MaybeUninit&lt;UnsafeCell&lt;T&gt;&gt;</code> through a shared pointer?</p>
</blockquote>
<p>I do not think it is UB, but I'd consider it unclear code. If we think of <code>MaybeUninit</code> as "<code>Option</code> without the tag", then what you want here is definitely <code>UnsafeCell&lt;Option&lt;T&gt;&gt;</code>, not <code>Option&lt;UnsafeCell&lt;T&gt;&gt;</code>, which differ by whether the tag is mutable when shared or not.</p>



<a name="215189046"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215189046" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215189046">(Oct 31 2020 at 12:18)</a>:</h4>
<p><span class="user-mention" data-user-id="327642">@Joshua Chartier</span> it sounds a bit like you assume that readuing uninit memory is UB in Rust. It is not, but somehow this is a common belief. But there is no such clause <a href="https://doc.rust-lang.org/reference/behavior-considered-undefined.html">listed here</a>.</p>



<a name="215189054"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215189054" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215189054">(Oct 31 2020 at 12:18)</a>:</h4>
<p>Reading uninit memory is UB <em>at some types</em>, just like reading <code>0x03</code> is UB at some types (namely, <code>bool</code>).</p>



<a name="215207115"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215207115" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215207115">(Oct 31 2020 at 19:12)</a>:</h4>
<blockquote>
<p>I do not think it is UB, but I'd consider it unclear code. If we think of MaybeUninit as "Option without the tag",</p>
</blockquote>
<p>This is the part that confuses me. If it's an option without the tag, then when it is in None state it should not be modifiable, even if it would be if it were in the Some(UnsafeCell) state</p>



<a name="215209404"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215209404" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215209404">(Oct 31 2020 at 20:03)</a>:</h4>
<p>isn't the point here do be able to take a shared ref to and initialize it through that?</p>



<a name="215211549"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215211549" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215211549">(Oct 31 2020 at 20:54)</a>:</h4>
<p>I don't disagree that <code>UnsafeCell&lt;MaybeUninit&lt;T&gt;&gt;</code> is better for this use case. I'm just double checking that there is no special case around <code>MaybeUninit&lt;UnsafeCell&lt;T&gt;&gt;</code> that would make it equivalent, which your earlier comment suggested</p>



<a name="215215752"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215215752" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215215752">(Oct 31 2020 at 22:56)</a>:</h4>
<p>Actually, I've managed to phrase the difference between both types, and why they <strong>do not commute</strong>: while you can write an initialised <code>T</code> through a shared reference to both types, you can only write an uninit <code>T</code> through a shared reference to a <code>UC&lt;MU&lt;T&gt;&gt;</code>, and not a <code>MU&lt;UC&lt;T&gt;&gt;</code></p>



<a name="215215836"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215215836" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215215836">(Oct 31 2020 at 22:59)</a>:</h4>
<p>At least theoretically. The current implementation makes enough guarantees about the layout and the freeze-ness of these types that I can't think of a way the compiler could exploit this difference, but library crates would very much like to (<em>c.f.</em>, my previous post).</p>



<a name="215234217"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215234217" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215234217">(Nov 01 2020 at 08:46)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/215211549">said</a>:</p>
<blockquote>
<p>I don't disagree that <code>UnsafeCell&lt;MaybeUninit&lt;T&gt;&gt;</code> is better for this use case. I'm just double checking that there is no special case around <code>MaybeUninit&lt;UnsafeCell&lt;T&gt;&gt;</code> that would make it equivalent, which your earlier comment suggested</p>
</blockquote>
<p>there is no special case but I think they are mostly equivalent if you go down to the operational semantics with Stacked Borrows -- <code>UnsafeCell</code> affects the locations on which it sits, and that is the same in both cases.<br>
But due to their conceptual difference I'd advice against doing that.</p>



<a name="215241684"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215241684" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215241684">(Nov 01 2020 at 12:12)</a>:</h4>
<p>Wait, so if you have a <code>Result&lt;u32, UnsafeCell&lt;u32&gt;&gt;</code> then it's not UB to modify the <code>Ok(ref n)</code> case through a shared pointer?</p>



<a name="215241702"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215241702" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215241702">(Nov 01 2020 at 12:13)</a>:</h4>
<p>this seems undesirable... but also off topic for this thread. I think there is a relevant UCG issue about this somewhere</p>



<a name="215260828"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215260828" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215260828">(Nov 01 2020 at 20:29)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/215241702">said</a>:</p>
<blockquote>
<p>this seems undesirable... but also off topic for this thread. I think there is a relevant UCG issue about this somewhere</p>
</blockquote>
<p><a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/236">https://github.com/rust-lang/unsafe-code-guidelines/issues/236</a></p>



<a name="215260838"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215260838" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215260838">(Nov 01 2020 at 20:29)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/215241684">said</a>:</p>
<blockquote>
<p>Wait, so if you have a <code>Result&lt;u32, UnsafeCell&lt;u32&gt;&gt;</code> then it's not UB to modify the <code>Ok(ref n)</code> case through a shared pointer?</p>
</blockquote>
<p>that is not at all what I said but also true under the current implementation of Stacked Borrows</p>



<a name="215260857"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215260857" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215260857">(Nov 01 2020 at 20:30)</a>:</h4>
<p>we were not talking about an enum so I am confused by the segway^^</p>



<a name="215261119"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215261119" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215261119">(Nov 01 2020 at 20:34)</a>:</h4>
<p>an enum is just a union with a discriminant</p>



<a name="215264732"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215264732" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215264732">(Nov 01 2020 at 22:07)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/215261119">said</a>:</p>
<blockquote>
<p>an enum is just a union with a discriminant</p>
</blockquote>
<p>no, the two are much more different than that</p>



<a name="215264739"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215264739" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215264739">(Nov 01 2020 at 22:07)</a>:</h4>
<p>unions have no "active variant" or so, they are just syntactic sugar for <code>transmute</code> on each access</p>



<a name="215264747"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215264747" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215264747">(Nov 01 2020 at 22:07)</a>:</h4>
<p>that is very different from enums</p>



<a name="215264814"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215264814" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215264814">(Nov 01 2020 at 22:08)</a>:</h4>
<p>if you look at <a href="https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/value-domain.md">my proposal for what an "abstract value" could be</a> in the rust abstract machine, you'll notice <code>Variant</code> for enums and <code>RawBag</code> for unions.</p>



<a name="215264837"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215264837" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215264837">(Nov 01 2020 at 22:09)</a>:</h4>
<p>also formally speaking, "union" and "disjoint union" (aka enum) are entirely distinct concepts with very different properties (e.g. in type theory or category theory)</p>



<a name="215268071"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215268071" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215268071">(Nov 01 2020 at 23:28)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/215264739">said</a>:</p>
<blockquote>
<p>unions have no "active variant" or so, they are just syntactic sugar for <code>transmute</code> on each access</p>
</blockquote>
<p>Ah, that is good to know. I was working under the assumption that the typing condition for a union is the disjunction of the members. So this implies that unions have no validity invariant then, they are just a "bag of bytes"? (Edit: I guess you just said as much.)</p>



<a name="215269694"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215269694" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Quy Nguyen <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215269694">(Nov 02 2020 at 00:15)</a>:</h4>
<p>From reading the UCG issue on unions the validity invariant should be that, althoguh there's the caveat that padding bits are indeterminate so bag of bytes might not be the best model.</p>



<a name="215272378"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215272378" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Lifshay <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215272378">(Nov 02 2020 at 01:28)</a>:</h4>
<p>so, wait, if I have <code>union U { v: bool }</code> I can store <code>3</code> in <code>U</code>?!</p>



<a name="215272571"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215272571" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215272571">(Nov 02 2020 at 01:34)</a>:</h4>
<p>apparently...</p>



<a name="215272580"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215272580" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215272580">(Nov 02 2020 at 01:34)</a>:</h4>
<p>although you will not be able to do so anyway without unsafe code</p>



<a name="215272638"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215272638" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215272638">(Nov 02 2020 at 01:36)</a>:</h4>
<p>This just means that storing 3 in <code>U</code> is not insta-UB as it would be in a bool, because there is no easy accidental deref happening with unions</p>



<a name="215272643"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215272643" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215272643">(Nov 02 2020 at 01:36)</a>:</h4>
<p>it is still UB to read 3 from <code>U.v</code></p>



<a name="215952201"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215952201" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215952201">(Nov 07 2020 at 12:09)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/215268071">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/215264739">said</a>:</p>
<blockquote>
<p>unions have no "active variant" or so, they are just syntactic sugar for <code>transmute</code> on each access</p>
</blockquote>
<p>Ah, that is good to know. I was working under the assumption that the typing condition for a union is the disjunction of the members. So this implies that unions have no validity invariant then, they are just a "bag of bytes"? (Edit: I guess you just said as much.)</p>
</blockquote>
<p>FWIW, even if the validity of union would be the disjunction of the field validity (which is definitely too weak, and the <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/73">relevant UCG issue</a> has counterexamples for that), that would not imply that there'd an "active variant" in the operational semantics. for example, if the current bit pattern is valid for multiple of the fields, an "active variant" still remembers which field the data "really belongs to"; Rust has nothing like that.</p>



<a name="215952249"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215952249" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215952249">(Nov 07 2020 at 12:10)</a>:</h4>
<p>"no active variant" does not imply "bag of bytes" (but the other way around holds)</p>



<a name="215962399"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215962399" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215962399">(Nov 07 2020 at 16:31)</a>:</h4>
<p>Well yes, of course there are other possible invariants one could assert, and in the UCG issue a few are proposed, but they are all more complicated than the "obvious" one. In that issue, it seems you set the stage in the first post by requiring that</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">union</span> <span class="nc">Mix</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">f1</span>: <span class="p">(</span><span class="kt">bool</span><span class="p">,</span><span class="w"> </span><span class="kt">u8</span><span class="p">),</span><span class="w"> </span><span class="n">f2</span>: <span class="p">(</span><span class="kt">u8</span><span class="p">,</span><span class="w"> </span><span class="kt">bool</span><span class="p">)</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">m</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">Mix</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">f1</span>: <span class="p">(</span><span class="kc">false</span><span class="p">,</span><span class="w"> </span><span class="mi">3</span><span class="p">)</span><span class="w"> </span><span class="p">};</span><span class="w"></span>
<span class="n">m</span><span class="p">.</span><span class="n">f2</span><span class="p">.</span><span class="mi">0</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">3</span><span class="p">;</span><span class="w"></span>
</code></pre></div>
<p>be valid code, but this was never challenged. Can I ask why you think this is a good idea? To me, this seems analogous to having an uninitialized field <code>m.f2.1</code>, and such a value should not be allowed to escape; i.e. it is not actually valid for the type and a reachability analysis ensures that it isn't used before the field is assigned.</p>



<a name="215962411"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215962411" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215962411">(Nov 07 2020 at 16:31)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span></p>



<a name="215962550"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215962550" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215962550">(Nov 07 2020 at 16:34)</a>:</h4>
<p>(Also, FWIW while I am in favor of the disjunction formulation, I don't think that we should have an "active variant" in the sense of C, that is, a ghost discriminant value. <code>union{f:u8, g:u8}</code> should be equivalent to <code>u8</code>.)</p>



<a name="215962789"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215962789" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215962789">(Nov 07 2020 at 16:40)</a>:</h4>
<p>FWIW, I did not come up with this example, it was given in an earlier RFC about unions (I forgot which one...)</p>



<a name="215962813"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215962813" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215962813">(Nov 07 2020 at 16:41)</a>:</h4>
<p>I think the question ought to be "why should this be disallowed" -- the entire point of unions is to be convenient syntactic sugar for transmutes (IMO), and unions with tuple fields should permit "per-field transmutes".</p>



<a name="215962949"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215962949" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215962949">(Nov 07 2020 at 16:44)</a>:</h4>
<p>any little bit of UB we add here will mean additional footguns for unsafe code that is already error-prone (since it uses unions)</p>



<a name="215962974"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215962974" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215962974">(Nov 07 2020 at 16:45)</a>:</h4>
<p>the disjunction formulation is also awfully non-constructive -- when dynamically checking if a value is valid for a type, it would have to attempt each variant in sequence</p>



<a name="215963046"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215963046" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215963046">(Nov 07 2020 at 16:46)</a>:</h4>
<p>and things get even worse when considering that the validity invariant is really just a projection of the representation relation, as <a href="https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/value-domain.md">I sketched here</a>: if we take the unions of the representation relations of the fields, I am pretty sure that will be utter nonsense (I can come up with an example later)</p>



<a name="215963145"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215963145" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215963145">(Nov 07 2020 at 16:48)</a>:</h4>
<p>I think you are probably right that this is untenable, in particular dynamic checking. I just want to program directly in separation logic ^_^</p>



<a name="215963342"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215963342" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215963342">(Nov 07 2020 at 16:52)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/215963145">said</a>:</p>
<blockquote>
<p>I think you are probably right that this is untenable, in particular dynamic checking. I just want to program directly in separation logic ^_^</p>
</blockquote>
<p>you mean like this thing some of my colleagues have been working on? :D<br>
<a href="https://plv.mpi-sws.org/refinedc/paper.pdf">https://plv.mpi-sws.org/refinedc/paper.pdf</a></p>



<a name="215963350"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215963350" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215963350">(Nov 07 2020 at 16:52)</a>:</h4>
<p>I hope we'll have that for Rust one day^^</p>



<a name="215964925"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/215964925" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#215964925">(Nov 07 2020 at 17:28)</a>:</h4>
<p>oh, I've been scooped</p>



<a name="218172689"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218172689" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218172689">(Nov 28 2020 at 17:20)</a>:</h4>
<p><span class="user-mention" data-user-id="327642">@Joshua Chartier</span> sorry for the long silence. I finally looked at your diagram in detail. This is great, thank you so much for drawing it!<br>
I think that the key property you need is something like "location-independence" of shared data. You basically want do move data, which is trivial to do with owned data, but not with shared data as there can be aliases.<br>
Mutability is indeed breaking location-independence, because mutation is a way to "test ptr equality": write through one pointer, see if what you read through the other pointer changed.<br>
But it is not the only location-independence-breaking operation -- I could imagine a type that takes its address and then relies on staying at that address. Given that everything owned is movable in Rust, this is tricky to arrange, but not impossible. For once, I could use pinning. However, container types can control if they support containing pinned data (by default they do not, "pinning projections" are needed to support them), so I think this is not a problem.</p>



<a name="218172751"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218172751" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218172751">(Nov 28 2020 at 17:21)</a>:</h4>
<p>But I could imagine more obscure patterns along the lines of <a href="https://github.com/rust-lang/rust/issues/49206#issuecomment-376002169">this</a>. I can try to come up with something a bit more tangible if that helps.</p>



<a name="218173015"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218173015" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218173015">(Nov 28 2020 at 17:29)</a>:</h4>
<p>FWIW, the formal model of shared references that we used in LambdaRust does not guarantee location-independence of any kind. We needed this primarily for interior mutability, but made no attempt to guarantee location-independence of non-interior-mutable types. In other words, this is a property that is independent of the rest of the Rust type system -- the lang team at some point has to make a call either way, which will rule out one piece of code or another.</p>



<a name="218307674"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218307674" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218307674">(Nov 30 2020 at 16:12)</a>:</h4>
<p>The kind of type I am worried about is something like <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=f244d2756a23122f5da5968d388daf0e">this weird <code>Singleton</code> type</a>. If I understand your diagram correctly, then you might move <code>Singleton</code> while it is in use by another thread.<br>
Usually, this type offers the guarantee that between two <code>observe</code> calls with the same id, all other calls that might occur will have the same <code>x</code>. But with your type, that guarantee cases to hold. So in some fundamental way your type is letting safe code do something that it otherwise couldn't.</p>



<a name="218382740"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218382740" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218382740">(Dec 01 2020 at 05:38)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> First off, thank you for your time on this and I like the location-independence nomenclature! Perhaps my diagram was little misleading... It's more like splitting the move into a new copy that takes over drop responsibilities and a delayed deallocation. For the Singleton case, x would still have the same value because within the borrow the data referenced is in the same location; it's just that  another thread may have moved on to the new copy. I do reference count just to make sure I don't drop the old allocation until all the borrows are completed, but I'm not technically moving anything in a shared borrow. That said, the location independence is still a vital characteristic of this setup. If you had an child struct keeping track of its parent's location, and the parent was in my ArcLog, that would be a problem. But my assumption is that this already a problem generally in Rust given that moves are allowed and there are no hooks that allows someone to keep track of when a struct is moved. If those hooks did existed, it seems reasonable for that child to expect there to be only one copy of the given parent and that after a move the child should no longer expect calls from the old location. My code could/would break that expectation.</p>



<a name="218402004"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218402004" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218402004">(Dec 01 2020 at 10:14)</a>:</h4>
<p>If I understood correctly, with your code, it can be the case that a shared object finds itself at another location without the sharing ever stopping -- is that accurate? If so, I would describe this as "moving data behind a shared reference".<br>
This is observably different from ending the sharing, moving the object, and then starting sharing again. The latter is of course universally possible for all types in safe code. But doing the move <em>without ending the sharing</em>, like I think you are, is not usually possible.</p>



<a name="218402173"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218402173" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218402173">(Dec 01 2020 at 10:16)</a>:</h4>
<blockquote>
<p>It's more like splitting the move into a new copy that takes over drop responsibilities and a delayed deallocation.</p>
</blockquote>
<p>I could agree with this if it was the case that there definitely was no access to the copy of the object whose deallocation is shared. But if I understood correctly, this is all concurrent, and other threads can still read from the old copy even after the new copy was created?</p>



<a name="218478581"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218478581" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218478581">(Dec 01 2020 at 20:42)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat/near/218402004">said</a>:</p>
<blockquote>
<p>If I understood correctly, with your code, it can be the case that a shared object finds itself at another location without the sharing ever stopping -- is that accurate?</p>
</blockquote>
<p>I guess it depends on what you consider the object. Let's take a Box&lt;T: Sync&gt; as an example. A Box consists of a pointer and a heap allocated T. When the capacity of ArcLog&lt;Box&lt;T&gt;&gt; is reached, I create a shallow copy of all the Box pointers using core::ptr::copy_nonoverlapping. So each T will now have two pointers pointing toward it and both can/do have shared borrows. This a violation of the Box unique ownership invariant, but I'm arguing that since I don't give out any kind of mutable access, and I eventually restore that invariant, it's a benign violation. From the perspective of existing borrower, nothing has changed as they shouldn't care about my copying of their pointer. Likewise, new borrows shouldn't care about the existence of the old pointer either. Once the old borrows are complete (all the existing ArcLogs have moved to the new allocation of pointers), I deallocate the old set of pointers (without dropping the Ts) and we're back to Box having one unique pointer. And when the last ArcLog is dropped, I also drop all of the Boxes. So the question is, is my violation of the uniqueness of the Box pointer and multiple immutable access to it's underlying T actually ok? I think it's pretty clear I can't just copy_nonoverlapping something mutable (like a Mutex) and expect it'll end up in a valid state, but beyond that, is the compiler making assumptions about uniqueness that makes having this kind of temporary split ownership problematic?</p>



<a name="218492163"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218492163" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218492163">(Dec 01 2020 at 22:36)</a>:</h4>
<blockquote>
<p>This a violation of the Box unique ownership invariant, but I'm arguing that since I don't give out any kind of mutable access, and I eventually restore that invariant, it's a benign violation.</p>
</blockquote>
<p>It is unclear if there is such a thing as a benign violation, see <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/258">https://github.com/rust-lang/unsafe-code-guidelines/issues/258</a>.</p>
<p>But that is not even my point. For <code>Box</code>, if we ignore aliasing rules, what you are saying makes sense. But I am asking you to consider the case of a general type <code>T</code> that you know nothing about.</p>
<blockquote>
<p>is the compiler making assumptions about uniqueness that makes having this kind of temporary split ownership problematic?</p>
</blockquote>
<p>Possibly, but that is besides the point. <em>Other code</em> may make assumptions that make having this kind of temporary split problematic. When someone then combines that other code with your code, we have UB. Now one could argue that it's the other code that is wrong, not your code, but that is an arbitrary choice -- nothing in Rust as it exists today says either way.</p>



<a name="218492199"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218492199" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218492199">(Dec 01 2020 at 22:36)</a>:</h4>
<p>(deleted)</p>



<a name="218492256"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218492256" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218492256">(Dec 01 2020 at 22:37)</a>:</h4>
<p>you have to find an argument that shows that <em>all types are location-independent when shared</em>. and I think this is just not true, there is no such rule in Rust. I <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=f244d2756a23122f5da5968d388daf0e">gave a counterexample</a>. We could <em>make</em> it a rule but that would be a fundamental change to the language, similar to how we made the rule that destructors need not be called. (And it would technically be a breaking change: now in principle all existing unsafe code needs to be audited to check that it is location-independent.)</p>
<p>This is just like Leakpocalypse: the presence of <code>Rc</code> and <code>Arc</code> (and <code>mem::forget</code>) made the old scoped thread API wrong, because that API relied on a guarantee that destructors need to run. Likewise, you are relying on a guarantee of location-independence. In both cases it is possible for unsafe code to violate that guarantee <em>without breaking any preexisting rule</em>.. Either API works in isolation, but putting them together yields an inconsistent system.</p>



<a name="218514339"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218514339" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218514339">(Dec 02 2020 at 04:31)</a>:</h4>
<p>I get where you're going with the counterexample, but I think it represents my miscommunication on how the borrowing works in my setup. Any ArcLog::method(&amp;self,...) (getting a slice) will only see one location within a call. In order to update to a new allocation you have to use ArcLog::method(&amp;mut self, ...) (push or update) so we do have guarantee that any particular instance of ArcLog will only be able to see one location at a time. Regaining exclusivity before moving to the new allocation is also a requirement for me to do proper reference counting of the borrows of the underlying. So I shouldn't be violating location-independence in a single borrow. But, thinking about interactions, if someone did something like creating a shortcut for equality that just compared locations, that would definitely produce unexpected results and seems like a reasonable thing to do. So yeah, location-independence is definitely something else that would be required. Good call. I really appreciate you helping me think this through!</p>



<a name="218532828"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218532828" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218532828">(Dec 02 2020 at 09:33)</a>:</h4>
<blockquote>
<p>Any ArcLog::method(&amp;self,...) (getting a slice) will only see one location within a call. In order to update to a new allocation you have to use ArcLog::method(&amp;mut self, ...) (push or update) so we do have guarantee that any particular instance of ArcLog will only be able to see one location at a time</p>
</blockquote>
<p>Can't I just clone the ArcLog to get an <code>&amp;mut</code> without duplicating the underlying data?</p>



<a name="218533178"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218533178" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218533178">(Dec 02 2020 at 09:36)</a>:</h4>
<p>with <code>Arc</code>, <code>&amp;mut self</code> is mostly meaningless (except for very special cases such as <code>Arc::get_mut</code>). Why is this different here?</p>



<a name="218533552"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218533552" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218533552">(Dec 02 2020 at 09:40)</a>:</h4>
<p>Maybe I misunderstood the API, but I thought I could do something like</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">ref1</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">ArcLoc</span>::<span class="n">with_capacity</span><span class="p">(</span><span class="mi">1</span><span class="p">);</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">ref2</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">ref1</span><span class="p">.</span><span class="n">clone</span><span class="p">();</span><span class="w"></span>
<span class="n">ref1</span><span class="p">.</span><span class="n">push</span><span class="p">(</span><span class="nb">Some</span><span class="p">(</span><span class="n">Singleton</span>::<span class="n">new</span><span class="p">()));</span><span class="w"> </span><span class="c1">// using my singleton type from before.</span>
<span class="n">rayon</span>::<span class="n">join</span><span class="p">(</span><span class="w"></span>
<span class="w">  </span><span class="k">move</span><span class="w"> </span><span class="o">||</span><span class="w"> </span><span class="n">ref1</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">as_ref</span><span class="p">().</span><span class="n">unwrap</span><span class="p">().</span><span class="n">observe</span><span class="p">(),</span><span class="w"> </span><span class="c1">// observes the shared singleton at the old location</span>
<span class="w">  </span><span class="k">move</span><span class="w"> </span><span class="o">||</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="n">ref2</span><span class="p">.</span><span class="n">push</span><span class="p">(</span><span class="nb">None</span><span class="p">);</span><span class="w"> </span><span class="c1">// creates a copy of the inner data</span>
<span class="w">    </span><span class="n">ref2</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">as_ref</span><span class="p">().</span><span class="n">unwrap</span><span class="p">().</span><span class="n">observe</span><span class="p">(),</span><span class="w"> </span><span class="c1">// observes the shared singleton at the new location</span>
<span class="w">  </span><span class="p">}</span><span class="w"></span>
<span class="p">)</span><span class="w"></span>
</code></pre></div>
<p>This could could end up observing the shared singleton at two different locations at the same time, which would be impossible without ArcLog (and hence, which code might <em>in principle</em> rely on never happening).</p>



<a name="218593103"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218593103" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Chartier <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218593103">(Dec 02 2020 at 17:46)</a>:</h4>
<p>Yes. That's true. I definitely break the Singleton promise. If you care about the actual value as an identifier, Arc&lt;Mutex&lt;Vec&lt;Singleton&gt;&gt;&gt;&gt; will also change the value (thread one could be with either the old location or the new location), but it does so at a definite point and thus it still preserves the singleton-ness. ArcLog allows both locations to coexist, so it's a singleton no more! Great example. So now I need Freeze+NonSingleton+LocationIndependent+...+... Ha, bummer. But super interesting. Thank you. As an aside, I really like how traits can be used to document/enforce assumptions/properties in Rust. I hope that a good backward compatibility story emerges for auto-traits because the more extensive the properties you have for your code, the more the compiler can help you progress and explore in a safe and productive way. Rust is already on a great track for this, but I feel like there's an opportunity to do much, much more!</p>



<a name="218599045"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218599045" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218599045">(Dec 02 2020 at 18:29)</a>:</h4>
<blockquote>
<p>I definitely break the Singleton promise. If you care about the actual value as an identifier, Arc&lt;Mutex&lt;Vec&lt;Singleton&gt;&gt;&gt;&gt; will also change the value (thread one could be with either the old location or the new location), but it does so at a definite point and thus it still preserves the singleton-ness. ArcLog allows both locations to coexist, so it's a singleton no more! </p>
</blockquote>
<p>Okay, we agree on this then. :)</p>



<a name="218599152"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218599152" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218599152">(Dec 02 2020 at 18:29)</a>:</h4>
<blockquote>
<p>NonSingleton+LocationIndependent</p>
</blockquote>
<p>FWIW I'd munge those together -- the <code>Singleton</code> type would simply not be <code>LocationIndependent</code>, since it clearly cares about its location.</p>



<a name="218599503"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218599503" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218599503">(Dec 02 2020 at 18:32)</a>:</h4>
<blockquote>
<p>So now I need</p>
</blockquote>
<p>There is an alternative: if you had a promise from the lang team that <code>Freeze</code> <em>implies location-independence</em>, then a data structure like yours can be made to work, I think. I have no idea if this is realistic, but I expect <code>!LocationIndependent</code> to be exceedingly rare. Furthermore, <em>maybe</em> this could be used to fix <a href="https://github.com/rust-lang/rust/issues/49206">https://github.com/rust-lang/rust/issues/49206</a> "by fiat".</p>



<a name="218601813"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/213817-t-lang/topic/Freeze%20stabilization%20and%20auto-trait%20backcompat/near/218601813" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/213817-t-lang/topic/Freeze.20stabilization.20and.20auto-trait.20backcompat.html#218601813">(Dec 02 2020 at 18:49)</a>:</h4>
<p>(completely unrelated and off topic, but every time I hear "by fiat" it makes me think of <a href="https://en.wikipedia.org/wiki/A_Canticle_for_Leibowitz">https://en.wikipedia.org/wiki/A_Canticle_for_Leibowitz</a>)</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>